We need to find at least at which layer there is a difference. As you surely noticed, urlmon is built from many layers, applications have access to those layers and interaction between them is visible to them. I'd hope that ultimately this MR would contain a test using both HTTP_STATUS_REDIRECT_KEEP_VERB and some other redirect status and would target exactly the layer that needs fixing (although it's possible that more than one layer needs fixing).
To get there, we need more experimentation. Those tests in current form show that there is some problem and that native uses a different solution. If there is a difference between binding using emulated protocol handler and a real protocol handler, it means that our emulated implementation does not serve its purpose (or the test is broken in another way). In that case, we need to find why. You may do more testing of http protocol handler (not using `CreateBinding`), look at result and analyze emulated http protocol handler and see where does that differ from the real one. If `CreateBinding` behaves differently with emulated protocol than real one, I'd expect there to be some difference. Finding it should give you more insight about what's going on.